Why I don't like SPDY

varnish-software.com

12 points·slyall··6 comments

Nothing is stopping browsers from supporting http 1.1 and SPDY at the same time. SPDY doesnt "force" anyone to support it. You just sound like the anti-change crowd to me. Irrelevant.

no no no - what we want is SPDY without encryption/signing.

http://williamedwardscoder.tumblr.com/post/20125275380/why-p...

For the few who can't just use StartSSL, couldn't you just use a self-signed certificate? I mean, it's suboptimal, but it's a far cry from "no way," isn't it?

Widespread usage of self-signed certificates might have the unfortunate effect of training people to click "allow invalid certificate" when they shouldn't (such as what happened with Vista's UAC).

I would also argue that unless your users are technically inclined, a self-signed certificate is as good as (or worse, due to the scary browser warnings) as an unencrypted connection.

It would be workable if browsers stopped loudly complaining about self-signed certificates and gracefully fell back to using something like TOFU/POP [1] or Convergence [2].

[1] http://www.xmlgrrl.com/blog/2010/07/06/tofu-online-trust-and... [2] http://convergence.io/

Ah, true. I wonder if it wouldn't be best if, by default, browsers would only complain when a site switched to an untrusted cert it hadn't used before (i.e. if Facebook.com is suddenly self-signed, that's a problem, and if a site switches from one self-signed cert to another, that's a problem as well). This would prevent most MITMs while still making self-signed certs useable. A site with a self-signed cert is better than one using no security at all, so it shouldn't get more flack.

Reply on news.ycombinator.com